The Opaserv-D is a variant of the Opaserv-A Worm. The Worm spreads through network shares. A file called Marco!.Scr will be created in the Windows subdirectory (folder) once the worm is executed.

• Run REGEDIT and delete the entry:
  
  • HKLM\Software\Microsoft\Windows\CurrentVersion\Run\cronos=Windows\marco.scr
  
  
• Click on "Start","Run". Type "EDIT C:\WINDOWS\WIN.INI" (for Windows 95,98) or Type "SYSEDIT C:\WINDOWS\WIN.INI" for Windows ME
  Find:  run= c:\Marco!.Scr
  run= c:\temp.ini
  and delete the line. Save WIN.INI. Exit.
  
  
• Run VBUSTER.EXE and use it to delete all occurances of the worm.

Return Home